[Winpcap-users] winpcap support for TOE?

Bryan Kadzban bryan at kadzban.is-a-geek.net
Mon Jan 28 00:21:20 GMT 2008

Hash: RIPEMD160

Athir Nuaimi wrote:
> Does anyone know if winpcap support network cards that use TOE?

It "supports" them just fine (nothing crashes), but capturing doesn't
deliver any packets.  Of course, neither does MS's "Network Monitor"
packet sniffer, FWIW.

The reason is probably in the WinPcap FAQ, but I'll repeat it here
anyway: Both netmon and winpcap are installed in a Windows system as
protocol drivers.  TCP offloading happens exclusively within the network
card's driver and the network hardware; therefore, no protocol driver
(including tcpip.sys, I believe) is able to see the packets.  Therefore,
no protocol driver is able to capture them either.

And no, there's no way to fix this: the reason that TOE is faster is
that the operating system isn't involved in processing each packet.  But
in order to capture any given packet (...or firewall it, for that
matter!), the OS *must* be involved.

I assume you've already done testing under load, with and without TOE,
and that testing has determined that you really do need it?
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org


More information about the Winpcap-users mailing list